Login Request a demo
Critical severity · published Feb 24, 2026
CVE-2026-26341
Tattile Smart+ / Vega / Basic <= 1.181.5 Default Credentials
9.8
CVSS
2.9%
EPSS
No
On KEV
Description
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during installation or commissioning. An attacker who can reach the management interface can authenticate using the default credentials and gain administrative access, enabling unauthorized access to device configuration and data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
ANPR Mobile · Tattile s.r.l.
through 1.181.5 · source: vendor
AC
Axle Counter · Tattile s.r.l.
through 1.181.5 · source: vendor
BM
Basic MK2 · Tattile s.r.l.
through 1.181.5 · source: vendor
SM
Smart+ · Tattile s.r.l.
through 1.181.5 · source: vendor
SS
Smart+ Speed · Tattile s.r.l.
through 1.181.5 · source: vendor
ST
Smart+ Traffic Light · Tattile s.r.l.
through 1.181.5 · source: vendor
TO
Tolling+ · Tattile s.r.l.
through 1.181.5 · source: vendor
VE
Vega11 · Tattile s.r.l.
through 1.181.5 · source: vendor
VE
Vega33 · Tattile s.r.l.
through 1.181.5 · source: vendor
VE
Vega53 · Tattile s.r.l.
through 1.181.5 · source: vendor
AM
Anpr Mobile Firmware · Tattile
through 1.181.5 · source: NVD
AC
Axle Counter Firmware · Tattile
through 1.181.5 · source: NVD
Affected product
AM
ANPR Mobile
Tattile s.r.l.
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-26341
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-26341
Product
https://www.tattile.com/
Third Party Advisory
https://www.vulncheck.com/advisories/tattile-smart-vega-basic-default-credentials
Exploit
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5977.php
More from ANPR Mobile
9.8
CVE-2026-26342
Tattile Smart+ / Vega / Basic <= 1.181.5 Insufficient Session Token Expiration
7.5
CVE-2026-26340
Tattile Smart+ / Vega / Basic <= 1.181.5 Unauthenticated RTSP Stream Disclosure